Re: [PATCH net] mptcp: reject DATA_ACKs against a reversed send interval

[Matthieu Baerts <matttbe@kernel.org>]

Hi Eric,

(+cc MPTCP list)

On 04/11/2026 14:07, Eric Dumazet wrote:
> From: Kyle Zeng <kylebot@openai.com>
> 
> ack_update_msk() samples snd_nxt before taking the data lock, but reads
> snd_una after taking it. Concurrent transmission and ACK processing can
> therefore leave the sampled upper bound behind snd_una. Active-open
> completion also exposes a reversed interval when it initializes snd_una
> to IDSN + 1 while the socket-owned state synchronization is deferred.
> 
> A peer-supplied 64-bit Data ACK half a sequence space away can pass both
> wraparound comparisons against such an interval. The resulting snd_una
> can make __mptcp_retrans() inflate a fragment's already_sent field. Later
> ACKs can then underflow data_len and cause out-of-bounds page fragments
> to be passed to TCP.
> 
> Read snd_nxt after acquiring the data lock and reject reversed intervals
> before checking the received Data ACK. This keeps the interval shorter
> than half the sequence space, so the existing upper-bound check cannot
> accept an advance beyond snd_nxt. Preserve the existing handling of old
> ACKs and keep the transmit fields under their existing socket locking.

Sorry, I missed this patch (the MPTCP CI didn't get it).

It looks good to me:

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

While at it:

Cc: stable@vger.kernel.org

@Net Maintainers: this patch can be applied to the net tree directly,
thank you! (Or did I miss my review window?)

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.